# Vexy Ransomware Claims Data-Extortion Attack on Majani Insurance Brokers (Kenya)

> Emerging ransomware/data-extortion group Vexy Ransomware has listed Majani Insurance Brokers, a Kenyan independent insurance broker, on its TOR data-leak site, claiming 2.1 GB of exfiltrated data and threatening release absent negotiation. The claim follows a pre-existing infostealer-driven credential/cookie exposure and an unresolved external vulnerability in Majani's environment, and remains independently unverified.

- **Published:** 2026-09-25T13:24:00Z
- **Last reviewed:** 2026-09-25T13:24:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2713
- **ID:** TL-2026-2713
- **Severity:** MEDIUM
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Vexy Ransomware
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Majani Insurance Brokers Ltd, a Kenyan independent insurance brokerage operating at majaninsure.com and arranging general business, motor, medical, life, investment, marine, liability, property and agricultural coverage for corporate and individual clients, was named on September 25, 2026 at 13:24 UTC as a victim on the TOR-hosted data-leak site of Vexy Ransomware, an emerging ransomware/data-extortion operation first observed roughly three weeks earlier (earliest tracked victim dated September 2, 2026). The group's leak-site statement claims Majani has been compromised and that sensitive data will be released unless negotiations commence; the listing claims 2.1 GB of exfiltrated data. As of this writing, Vexy's claim is unverified and Majani has issued no public confirmation.

Prior to the leak-site posting, a third-party exposure assessment (ParanoidLab, cited by DeXpose) of Majani's environment identified an active infostealer-driven credential-exposure footprint: 55 passwords (4 flagged critical), 7 session cookies, and compromised credentials tied to 1 confirmed end-user account plus 1 third-party/vendor employee account, alongside detected use of Google Workspace and Microsoft 365, and one identified external attack-surface vulnerability. This combination -- infostealer-harvested credentials and session cookies plus an unresolved internet-facing weakness -- is consistent with, though does not by itself prove, a credential- or exploit-driven initial-access path into a cloud-identity environment ahead of the extortion claim. No encryptor sample, ransom note, or confirmation of file/system encryption has been publicly identified for this specific victim, which distinguishes the incident, at least in its currently public form, as a data-theft/extortion claim rather than confirmed encryption-based ransomware.

Vexy Ransomware itself is a newly emerged, fast-moving data-broker / double-extortion operation first tracked in early September 2026. Across its first three-to-four weeks of activity it posted 16-17 victim listings spanning 11 countries -- concentrated in India, with additional victims in Brazil, Vietnam, Italy, Japan, the UK, the US, Argentina, Mexico, Ecuador and now Kenya -- and roughly 580 GB of cumulative claimed exfiltrated data, most heavily targeting technology, retail/e-commerce and manufacturing organizations. The group operates a TOR (.onion) data-leak site (Apache 2.4.68 on Debian, intermittently available across trackers) and negotiates through a published Tox messenger ID, with two Bitcoin wallet addresses associated with ransom collection. As a licensed insurance intermediary, Majani falls under Kenya's Insurance Regulatory Authority (IRA) rules -- introduced in 2025 -- which mandate disclosure of major cyber incidents, including unauthorized access to customer data, within 24 hours of detection.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1589 Gather Victim Identity Information
- T1583.001 Domains
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft
- T1090.003 Multi-hop Proxy

## Sources

- [Victim: Majani Insurance Brokers – Vexy Ransomware](https://www.ransomware.live/id/TWFqYW5pIEluc3VyYW5jZSBCcm9rZXJzQFZleHkgUmFuc29td2FyZQ==)
- [Vexy Ransomware Strikes Majani Insurance Brokers](https://www.dexpose.io/vexy-ransomware-strikes-majani-insurance-brokers/)
- [Vexy Ransomware | WatchGuard Technologies Ransomware Tracker](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/vexy)
- [Group: Vexy Ransomware](https://www.ransomware.live/group/Vexy%20Ransomware)
- [Vexy · RansomLook](https://www.ransomlook.io/group/vexy)
- [Vexy Ransomware Strikes Brazilian Adhesive Producer Engefitas](https://www.dexpose.io/vexy-ransomware-strikes-brazilian-adhesive-producer-engefitas/)
- [Sancity Listed by Vexy Ransomware Group](https://www.galaxywarden.com/blog/breach/sancity-vexy-2026-09)
- [MAJANI INSURANCE BROKERS – HackNotice](https://hacknotice.com/2026/09/25/majani-insurance-brokers/)
- [Kenya's Watchdog Tightens Grip on Insurers After Spike in Cyber Attacks and Data Breaches](https://techtrendske.co.ke/2025/07/13/kenya-cyber-insurance-rules-breach-reporting/)
- [Kenyan Insurance Companies Ordered to Report Cyber Attacks Within 24 Hours](https://techweez.com/2025/07/12/kenya-insurance-cyber-attacks-reporting/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2713